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| Foreword from the Information Commissioner 


As UK Information Commissioner, my job is to uphold information rights 
on the public’s behalf. I am tasked with regulating both the right to know, 
and the right to privacy. This dual mandate helps us adjudicate and 
balance between public interest scrutiny of public authorities and the 
protection of personal privacy. 


Inevitably, much attention has focused recently on the implementation 
and enforcement of the General Data Protection Regulation (GDPR) and 
the Data Protection Act 2018. Increasingly over the coming period 
regulators will need to understand the intersections and interplay between 
these different rights and responsibilities. Accountability and transparency 
are also driving forces in the GDPR. While the rules of transparency and 
fairness have not changed, organisations are now obliged to account for 
what they do, why and how they do it. I expect we will be seeing far more 
freedom of information (FOI) requests about the application of data 
privacy policies and practice. 


I am publishing this access to information strategy to set out our goals 
and priorities over the next three years. Access to information goes to the 
heart of a healthy, functioning democracy and has a key role to play in an 
era of increasing public concern and mistrust about misinformation and 
so-called ‘fake news’. This strategy explains my ambitions for a step 
change to the reactive, request-mode, which characterises our current 
freedom of information laws, and I know that to achieve this will require a 
mix of legal reform, improved practice and cultural change. 


The major priority in this new strategy is to ensure we focus on our role 
to enforce access to information rights through use of all of our regulatory 
powers. Guided by the framework in our Regulatory Action Policy, the 
Information Commissioner's Office (ICO) will be proactive in how we seek 
compliance with the law and how we hold public authorities to account. 


A key opportunity for all regulators is to ensure they remain relevant in a 
changing world. There is much to learn from the ways in which our data 
privacy legislation has now been updated to reflect the changing, global 
worlds in which it operates. It is my view, as set out in our ‘Outsourcing 
Oversight?’ report published earlier in the year, that access to information 
legislation now also needs a similar reboot to reflect the changing models 
of public service provision. I argued at the time of the report’s publication 
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for an urgent and constructive dialogue to bring about these changes and 
that remains a priority. 


I see encouraging examples of good practice from public authorities and 
their work to create a climate of openness by design. But I also hear the 
more negative narratives from public authorities of all sizes about the 
burdens and costs of complying with access to information legislation. 


Complying with the law is the best and easiest way to tackle these 
challenges and good leadership and effective governance are vital to 
creating an organisational climate of openness and transparency. I 
believe all public authorities can do more to strive towards making access 
to information rights count - to review how access to information rights 
are visible at board and senior management levels; to revisit approaches 
for proactive disclosure and to be exemplars of good practice in handling 
access to information requests. 


The aim of this strategy is to set out how we will achieve our mission to 
uphold information rights, and clearly this can only be achieved through 
working closely with those organisations we oversee, our stakeholders 
and members of the public. In seeking to deliver our goals, we will pay 
close attention to the ways in which we can work together to bring about 
positive change and build the trust and confidence in public authorities 
that the public rightly expect. 


Unlike our data protection fee income from data controllers, we are reliant 
on government grant-in-aid to fund our access to information work. Over 
the next three years, we expect to both continue to make the case for 
that funding, continue to deliver efficiencies in the ways we work and 
ensure our work plans are tailored to the resources available to us. 


Elizabeth Denham CBE 


Information Commissioner 
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| Openness by design - our strategy at a glance 


Access to information goes to the heart of a healthy, functioning 
democracy. Services that are accountable and transparent are better 
public services. 


Our ambition is to increase the impact of our oversight of access to 
information legislation. Our objective is encourage public bodies to comply 
with the law in the first instance, reducing the need for citizens to raise 
appeals with the Information Commissioner. Where necessary we will 
take enforcement action to secure compliance and uphold the law. 


We will achieve our ambition by: 


ensuring that access to information rights is upheld in a consistent 
and timely manner and operates effectively in a digital age; 


providing excellent customer service to individuals making requests 
to us and lead by example in fulfilling our own statutory functions; 


raising awareness of access to information rights and make it easier 
for the public to exercise their rights; 


promoting the reform of access to information legislation so it 
remains relevant for our modern society and fit for purpose; and 


further developing and sustaining our international collaboration, 
learning from the best initiatives around the world. 


We will know we have succeeded when: 


public authorities improve their compliance with access to 
information legislation; 


the public have more trust and confidence in the openness and 
accountability of public authorities; and 


awareness of access to information rights increases. 
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| Introduction 


This strategy sets out the Information Commissioner’s priorities over the 
next three years for the access to information legislation she regulates. 


The strategy relates to her powers and duties under the Freedom of 
Information Act (FOIA) 2000, the Environmental Information Regulations 
(EIR) 2004, and the Reuse of Public Sector Information Regulation 2014. 
These responsibilities are delivered alongside her regulation of data 
protection legislation and we recognise the important intersections 
between access to information and privacy rights. This access to 
information strategy is therefore aligned with the Information Rights 


Strategic Plan (IRSP) and the Regulatory Action Policy (RAP). 


We have prepared the strategy following a public consultation and 
amended it in light of the feedback we received. A summary of our 
responses to the feedback is available on the ICO website. 


Our vision 


Our ambition is to increase the impact of our oversight of access to 
information legislation. Our objective is encourage public bodies to comply 
with the law in the first instance, reducing the need for citizens to raise 
appeals with the Information Commissioner. Where necessary we will 
take enforcement action to secure compliance and uphold the law. 


Our values 
This strategy sets out our vision and makes clear that we will: 


e seek to achieve our goals through our Regulatory Action Policy 
which sets out our overall approach to regulation; and 


e put our organisational values at the heart of everything we do. 


Ambitious: we will be ready to test new boundaries and take advantage 
of new opportunities. We will work with a genuine sense of urgency, 
continually improving and striving to be the best we can be. 


Collaborative: we will work effectively with a wide range of partners, 
seeking to share information and expertise to achieve our collective goals. 


Service focused: we will work impartially and ethically to provide 
excellent services and innovate to remain relevant to the environment we 
regulate. 
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Our role 


In England, Wales and Northern Ireland, the Information Commissioner 
regulates FOIA and the EIR laws and undertakes independent reviews of 
access rights. Information held by Scottish public authorities is covered by 
Scotland’s own Freedom of Information (Scotland) Act 2002 and the 
Environmental Information (Scotland) Regulations 2004 under the 
jurisdiction of the Scottish Information Commissioner. 


The Information Commissioner has both a reactive and proactive role in 
access to information rights. 


Each year she receives approximately 6,000 individual requests from 
members of the public asking for an independent review of decisions 
made by public authorities. The Commissioner has a range of powers and 
duties to issue notices of her decisions to public authorities and powers to 
certify to the High Court if a public authority fails to comply with them. 
She also has powers to approve individual and model publication schemes 
prepared by public authorities and publish good practice 
recommendations in statutory codes of practice under FOIA. In turn, the 
principles of good administration adopted by public sector ombudsman 
schemes also reflect requirements for openness and accountability by 
public bodies. 


The Commissioner has important proactive responsibilities to inform the 
public of their rights to information. She publishes guidance about access 
to information rights, has a duty to promote good practice and the power 
to lay reports before Parliament about the exercise of her functions under 
FOIA. 


The Commissioner does not see delivery of her statutory functions as a 

choice between reactive and proactive responsibilities. Rather, over the 
coming period the Information Commissioner will use all her powers to 

drive forward improvements in standards of openness and transparency 
among public authorities and shine a light on where she finds systemic 

failings. 


The performance of some public authorities in the timeliness of their 
responses to information requests and overall levels of openness are not 
as high as we want and the public expect. We have listened to the calls 
for the Information Commissioner’s Office to do more to raise standards 
and reinforce confidence in access to information rights. 
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This strategy sets out our revised approaches and reflects the renewed 
commitment by the Information Commissioner to take a more robust, 
risk-based approach as laid out in her Regulatory Action Policy. We will do 
this through making proportionate use of all our regulatory tools, from 
education, advice, support and guidance through to the use of our 
enforcement powers. 


The Information Commissioner is also subject to the same requirements 
as other public bodies in relation to the Freedom of Information Act and 
Environmental Information Regulations. We will aim to be an exemplar for 
other public authorities in our consideration of requests for information 
made to us. 


Our strategic context 


In framing this new strategy, we are also supporting delivery of the goals 
set out in the IRSP: 


Goal #1 To increase the public’s trust and confidence in how data is used 
and made available. 


Goal #2 Improve standards of information rights practice through clear, 
inspiring, and targeted engagement and influence. 


Goal #3 Maintain and develop influence within the global information 
rights regulatory community. 


Goal #4 Stay relevant, provide excellent public service, and keep abreast 
of evolving technology. 


Goal #5 Enforce the laws we help to shape and oversee. 


Goal #6 To be an effective and knowledgeable regulator for cyber related 
privacy issues. 


In developing this strategy, we recognise that information rights 
legislation faces a number of challenges. While the first 13 years of 
freedom of information legislation in England, Wales and Northern Ireland 
has brought about a new culture of openness in many public authorities, 
this is not yet consistent across all of the public sector. There are 
important opportunities to develop new practices to reinforce more 
proactive transparency in a digital age. And as how we access and use 
information is continuing to change rapidly, freedom of information must 
keep pace if it is to continue to be effective. 
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The benefits of the provisions of FOIA and the EIR are still not always 
recognised and celebrated for the part they play in supporting the long- 
term health of our democracy as well as the accountability of public 
bodies. Access to information can provide an important catalyst for civic 
participation across a wide range of opportunities from local planning 
decisions to major infrastructure projects. 


Sometimes, considerable energy is expended on the perceived costs and 
burdens of the legislation on public authorities or due to spurious or 
vexatious requests. However, this approach often masks the real 
opportunities and obligations that public authorities have to improve their 
own information management and record keeping strategies, policies and 
processes and the value of securing confidence from those they serve 
through openness and transparency. 


Good record keeping practices, including the creation, management, 
retention and disposal of records, underpin compliance with access to 
information legislation. Planned and resourced record keeping facilitates 
not only the effective delivery of public services, but also enables 
accountability, openness and transparency. In turn, poor information 
governance can lead to additional compliance costs and risks damage to 
overall customer service and organisational reputation. 


Access to information legislation has not always kept pace with changes in 
the ways public services are planned, commissioned and delivered. It is 
clear that in practice more could be made of the opportunities presented 
by the development and use of new technologies. We want to increase 
our own understanding and promote good practice of how existing and 
new technologies can leverage increased openness and transparency for 
both public authorities and those requesting information. 


This strategy is intended to play its part in tackling these challenges. 


Importantly, we recognise that we cannot achieve the ambitions set out 
here by working alone, and a priority for us will be to continue to build 
our external strategic partnerships across the public, private and civil 
society sectors both in the UK and internationally. This includes working 
closely with national and local government for example. Organisations, 
such as the National Archives, are also key partners for us as we develop 
shared work in records management. 
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We are also mindful that to deliver this strategy we will continue to seek 
core grant-in-aid funding from government to deliver the full range of our 
statutory functions as casework volumes continue to increase. In turn, 
our ambitions and plans will need to be tailored to the resources available 
through grant-in-aid. 


Goal #1: Ensuring that access to information rights is upheld in 
a consistent and timely manner and operates effectively in a 
digital age 


FOIA was originally conceived in 1997 as part of a wider open 
government programme, designed to support a fundamental change in 
the relationships between government and the governed, putting 
accountability and openness as the heart of our democracy. Over the last 
twenty years, there is evidence that the legislation has made a difference 
to attitudes and behaviours, alongside important developments in case 
law. 


We want to encourage and inspire those we regulate to achieve the 
highest possible standards in their information rights practice. There are 
new opportunities to improve public access to information through open 
data initiatives and through the use of new search technologies. 


However, it is clear there are also some challenges about compliance with 
the existing law: the extent to which records of decisions are made; the 
timeliness of responses by some public authorities; the appropriate use of 
exemptions; or the extent to which publication schemes are being used to 
support proactive disclosure of information. 


As a regulator, we have wide powers to shine a light on good practice and 
to report to Parliament on thematic and systemic issues where we 
consider practice falls below expected standards. As such, our intention is 
for this strategy to signal a step change in our approach to supporting 
improvements to information governance. This approach is already 


signalled in our Regulatory Action Policy. 
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Strategic priorities 


To achieve improvements in compliance we will: 


prioritise increasing FOIA and the EIR compliance through targeting 
non-compliance and taking enforcement action consistent with the 
approaches set out in our Regulatory Action Policy; 


use insights from our casework and policy analysis from the 
external environment to scope and publish a series of special or 
own-motion studies that make recommendations for improvements 
in understanding, accountability, openness and transparency; 


develop, pilot and roll out a self-assessment toolkit for public 
authorities, targeted to increase compliance and include 
opportunities for advisory ICO audits; 


explore the feasibility of developing an online portal to share 
information about the performance of public authorities in 
responding to information requests; 


work in partnership with technology experts, FOIA practitioners and 
stakeholders to scope and publish a technology review to assess 
how public authorities are using technology to search for 
information; and 


work in partnership with public authorities and civil society 
organisations to research and promote new digital approaches to 
proactive disclosure of information, including making the most of 
open data opportunities. 


Goal #2: Providing excellent customer service to individuals 
making requests to us and lead by example in fulfilling our own 
statutory functions 


We have a varied range of individuals who request an independent review 
from us and a diverse range of public authorities within our jurisdiction 
from large central government departments to very small parish councils. 


Historically we have not sought systematic feedback from either those 
who bring a case to us, or from public authorities. In order to ensure we 
are focusing on issues that matter most to the public we need to better 
understand their concerns. The context in which we are providing our 
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services is changing rapidly, with not only sustained resource pressures 
on many public authorities but also increases to the volume of complaints 
we receive each year. 


We also need to review our processes, systems and procedures to ensure 
we are providing the very best possible customer service within our 
current resources, both in terms of quality and timeliness. 


Strategic priorities 
To achieve improvements to the services we provide we will: 
e devise, pilot and roll-out a programme for customer feedback; 


e use this feedback to inform the development of a new service 
charter setting out expectations for the public and public 
authorities; 


e review and implement improvements to our core processes, 
systems and procedures to meet customer needs and improve the 
efficiency and quality of the services we provide; and 


e review and develop new guidance for public authorities consistent 
with our Regulatory Action Policy, prioritising those areas of 
greatest impact and promoting our external guidance alongside the 
publication of our Decision Notices. 


Goal #3: Raising awareness of access to information rights and 
making it easier for the public to exercise their rights 


We know from our own published research that historically there has been 
a decline in public awareness of the right to request information from 
public bodies. We will use the results from our 2019 survey to provide a 
baseline for our awareness raising work. We also want to understand any 
differences in awareness among various groups of the population so we 
can target our awareness-raising and education efforts. 


Inevitably, we only consider a small proportion of the total information 
requests made to public authorities each year. It means there are 
opportunities to learn more about, promote and celebrate the everyday 
use of information rights and the difference they can make. We can also 
look at ways to make it easier for individuals to register concerns, as well 
as make formal requests for review. 
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At the moment, we receive around 30% of cases that are ‘premature’ or 
not ready for us to consider for a variety of reasons, often because a 
public authority has not yet carried out an internal review about a refusal 
to release information. While clearly we need to retain flexibility in how 
we take on cases, there are opportunities to make sure more individuals 
can come to us with their cases ready for consideration. 


Strategic priorities 
To achieve our goals we will: 


e draw on the learning from our ‘Your data matters’ campaign, to 
develop, deliver and evaluate a series of targeted information rights 
Campaigns to raise awareness of FOIA and the EIR rights and show 
how access to information makes a difference; 


e scope and assess the demand for resources for schools to support 
delivery of citizenship programmes; 


e develop new engagement channels to promote guidance, support 
and good practice for public authorities, including organising 
practitioner workshops; and 


e redesign our online forms to make it easier for individuals to know 
when we can help them and request a review from us. 


Goal #4: Promoting the reform of information rights legislation 
so it remains fit for purpose 


Since FOIA and EIR were implemented, there have been significant 
developments and changes in the way public services are commissioned 
and delivered, with an increased blurring of the boundary between ‘public’ 
and ‘private’. The legislation has not kept pace with these changes and as 
a result there is a widening ‘transparency gap’ that undermines access to 
information rights and public trust. 


We published our report ‘Outsourcing Oversight’ to Parliament in January 
2019, making recommendations for change to outsourced public services 
and some other categories of public service provision that are not within 
the scope of current legislation. 


We will continue to keep the operation of both the FOIA and the EIR 
under review and seek the views of our stakeholders and civil society 
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organisations to make further recommendations for changes to legislation 
that will improve access to information rights. 


Access to information rights depends on public authorities documenting 
their key activities and decisions. Failure to do this can undermine public 
accountability, the historical record and public trust. We are therefore 
interested to explore further, whether ‘duty to document’ approaches 
provide a way to address these issues across England, Wales and 
Northern Ireland. 


Strategic priorities 
To ensure the legislation we regulate remains fit for purpose we will: 


e continue to build and promote the case for changes to the scope of 
FOIA and the EIR legislation, working closely with colleagues in 
government and Parliament, public authorities, the private sector, 
civil society organisations, the media and the public; 


e engage and consult with our stakeholders to review other potential 
areas for legislative change; and 


e work with regulators and stakeholders including The National 
Archives to explore the practical application of duty to document 
frameworks. 


Goal #5: Further developing and sustaining new international 
partnerships 


FOIA has been used historically as a model for legislation in several 
jurisdictions around the globe and the ICO has a positive tradition of 
supporting the development of legislation and sharing practice across the 
world. 119 countries now have access to information legislation. 


Improving standards of access to information practices, and maintaining 
and developing influence within the global information rights community 
are two of the key pillars of the IRSP. We are meeting both of these goals 
by our partnership work to support the development of the International 
Conference of Information Commissioners (ICIC)'. Major progress has 
been made at the ICIC held in South Africa in 2019, with the adoption of 
the Johannesburg Charter to lay the foundations for the future 
development of this global forum. 
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Strategic priorities 
To build and sustain our international collaboration we will: 


e promote standards of openness and transparency globally, and 
continue to support the strengthening of a global voice for access to 
information rights through our work to provide the Secretariat for 
the International Conference of Information Commissioners; 


e work in partnership with UNESCO and international colleagues to 
contribute towards the promotion of access to information rights, as 
part of the achievement of the United Nations Sustainable 


Development Goals framework; 


e continue to learn from good practice globally to support the further 
development and upholding of access to information rights; and 


e continue to promote access to information rights as part of the 
wider work of the Open Government Partnership 


| Measuring progress 


To develop the proposals in this new strategic plan, we want to set out an 
ambitious programme of change that we believe will make a real 
difference to upholding access to information rights. 


As part of the work to deliver our overarching IRSP we will assess our 
progress in achieving the goals set out in this strategic plan and the 
impact of our work. This will include gathering and acting on customer 
feedback and our annual information rights track survey. Each year we 


will report progress in the Information Commissioner's Annual Report. 


' The International Conference of Information Commissioners (ICIC) brings together 
freedom of information commissioners from across the globe to promote and share 
issues affecting public transparency and access to official information, identifying 
emerging challenges and sharing best practice. The vision of the ICIC is to be the global 
forum, which connects Information Commissioners responsible for the protection and 
promotion of access to information laws in order to improve transparency and 
accountability to the benefit of everyone. 
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